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IN THE SPECIFICATION: 

Replace the paragraph beginning on page 1, line 4 with the following: 
This application claims the benefit of U.S. Provisional Application No. 

60/1/11.581 6 0/140.581. filed on June 23, 1999. 



Replace the paragraph beginning on page 4, line 21 with the following: 
When a process on a WINDOWS NT brand operating system system t ries to open 
a file that resides on a remote computer, the following steps occur: 

• The process calls the I/O Manager to request that the file be opened. 

• The I/O Manager recognizes that the request is for a file on a remote computer, so 
it passes it to the redirector file system driver 22 (RDR.Sys). 

• The redirector 22 passes the request to lower-level network drivers that transmit it 
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to the remote Server 26 for processing. 

• The transport receives a send 10 request packet (Irp) for the SMB header and 
command. 

• This send is translated into frames and queued for dispatch on the wire through 
the Miniport driver. 

IN THE CLAIMS: 

Amend claims 4, 6, 10, 15, and 18 and add claims 22, 23, and 24 as follows: 
4. (Amended) A method of tracing a transmission of data over a computer 
network comprising: detecting the presence o f a transport-layer request to transmit an 
input/output packet requesting a transmission ; searching the input/output request packet 
to determine the-an identity of the-<Lprocess that created the input/output request packet; 
and storing in a trace log an entry representing the transmissio nr equest , wherein the entry 
comprises the identity of the process, and wherein the trace log is accessible to determine 
the-ayolume of data being transmitted over the network. 

6. (Amended) A method of tracing a receipt of data from a computer 
network comprising: detecting the presence of a transport-layer request to transmit a 
packet for an input/output connection to a port; searching the packet to determine the-an 
identity of the-aprocess that created the packet; and in response to the detection of a 
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receipt of data at the port, storing in a trace log an entry representing the receipt of the 
data, wherein the entry comprises the process identification, and wherein the trace log is 
accessible to determine the-a_volume of the data being transmitted over the network. 

10. (Amended) A facility for tracing data traffic on a network, the facility 
comprising: an identifying means for identifying a process causing a transport-layer 
request to transmit data t ransmission or receipt of a communication via the network; and 
a logging means in communication with the identifying means for logging and event, 
wherein the event comprises the identification the process and wherein the logging means 
is useable to determine the-avolume of data traveling over the network. 

15. (Amended) A computer-readable medium having stored thereon 
computer-executable instructions for performing steps comprising: detecting the 
presence of a transport-layer request to transmit an input/output packet requesting a 
transmission ; searching the input/output request packet to determine the-an identity of the 
aprocess that created the input/output request p acket; and storing in a trace log an entry 
representing the transmission request wherein the entry comprises the identity of the 
process, and wherein the trace log is accessible to determine the-ayolurne of data being 
transmitted over the network. 
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18. (Amended) A computer-readable medium having stored thereon 
computer-executable instructions for performing the steps comprising: detecting the 
presence of a transport-layer request to transmit a packet for an input-output connection 
to a port; searching the packet to determine the-an identity of the-a_process that created 
the packet; and in response to the detection of a receipt of data at the port, storing in a 
trace log an entry representing the receipt of the data, wherein the entry comprises the 
process identification, and wherein the trace log is accessible to determine the volume of 
the data being transmitted over the network. 

22. (New) The method of claim 1, wherein the transmission of data is recorded 
at the completion of the transmission indicated by an acknowledgement from the first 
device. 

23. (New) The method of claim 1, wherein the receipt of data is recorded at the 
receipt of a first block of data and a last block of data. 

24. (New) The method of claim 4, wherein the identity of the process includes a 
port number or an IP address relating to the transmission. 
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